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ABSTRACT 

A significant flight hazard associated with liquid 
propellants, such as those used in the upper stage of 
NASA’s new Ares I launch vehicle, is the possibility of 
leakage of hazardous fluids resulting in a catastrophic 
fire/explosion. The enclosed and vented interstage of 
the Ares I contains numerous oxidizer and fuel supply 
lines as well as ignition sources. The potential for 
fire/explosion due to leaks during ascent depends on the 
relative concentrations of hazardous and inert fluids 
within the interstage along with other variables such as 
pressure, temperature, leak rates, and fluid outgasing 
rates. This analysis improves on previous NASA 
Probabilistic Risk Assessment (PRA) estimates of the 
probability of deflagration, in which many of the 
variables pertinent to the problem were not explicitly 
modeled as a function of time. This paper presents the 
modeling methodology developed to analyze these 
risks. 

1. MOTIVATION 

NASA’s Marshall Space Flight Center is currently 
developing hardware and systems for the Ares I rocket 
that will send future astronauts into orbit. Built on 
cutting-edge launch technologies, evolved powerful 
Apollo and Space Shuttle propulsion elements, and 
decades of NASA spaceflight experience, Ares I is the 
essential core of a safe, reliable, cost-effective space 
transportation system. The development of safe and 
reliable launch vehicles is vitally important to Ares I 
mission success. Probabilistic modeling and simulation 
of phenomenological events is an important component 
of the Ares I Upper Stage Element PRA. 

A significant flight hazard associated with liquid rockets 
is the possibility of leakage of hazardous fluids, such as 
liquid oxygen and hydrogen, resulting in a catastrophic 
fire/explosion. A primary function of the Ares I Upper 
Stage Main Propulsion System is to supply stored 
propellants to the J-2X Upper Stage Engine (USE). The 
enclosed and vented interstage contains numerous 
oxidizer and fuel supply lines as well as ignition 
sources. The potential for fire/explosion due to leaks 


during ascent depends on the relative concentrations of 
hazardous and inert fluids within the interstage along 
with other variables such as pressure, temperature, leak 
rates, and fluid outgasing rates. This dynamic 
environment must be modeled in order to obtain 
credible estimates of the probability of deflagration for a 
range of credible leakage scenarios. This analysis 
improves upon the methodology used in the Space 
Shuttle PRA, which did not explicitly model many of 
the time-dependent variables that are pertinent to the 
problem. 

2. PURPOSE AND SCOPE 

2.1. Purpose 

The purpose of this paper is to explain the modeling 
methodology used to estimate the risk of fire or 
explosion due to hydrogen and oxygen leaks in the 
Ares I interstage for the NASA Ares I Upper Stage 
Element PRA. It also provides information on how 
various relevant data were collected and a description of 
the output from the model. 

2.2. Scope 

The scope of this study is the Ares I Design Analysis 
Cycle 2A (DAC-2A) configuration. The region of the 
vehicle considered is the enclosed volume of the aft 
skirt, interstage, and forward frustum, and the enclosed 
volume of the thrust cone. The timeline of analysis 
begins at liftoff and ends at first stage separation. 
Leakages from the Main Propulsion System (MPS) and 
USE are considered. The primary scenarios considered 
pertain to hydrogen and oxygen leaks. Secondarily, we 
considered scenarios involving air incursion. 

3. INTERSTAGE DESIGN 
3.1. Configuration Overview 

The interstage region is defined as the region consisting 
of the aft skirt, the interstage, and the forward frustum. 
The interstage is the primary structural interface 
between the Ares I first stage and upper stage, and it 
encloses the thrust cone and USE. The interstage is 



attached to the aft skirt of the upper stage at one end, 
and the forward frustum at the other end. The primary 
function of the frustum is to interface between the 
smaller diameter first stage and the larger diameter 
upper stage. The forward frustum attaches to the first 
stage forward skirt extension. The structure at the top 
of the first stage forward skirt extension is the aeroshell. 
The aeroshell protects the drogue and pilot parachutes 
during flight and reentry. The layout shown in Figure 1 
depicts the region described. 



Figure 1. DAC-2 schematic of interstage region 


3.2. Volume of Interstage Enclosure 

The volume of the interstage was estimated from design 
schematics and by assuming the interstage is made up of 
two perfect cylinders and one frustum, and then 
subtracting out the volumes of a cone representing the 
USE, a cone representing the aeroshell, and a portion of 
a sphere representing the oxygen tank. An additional 
percentage of the total was subtracted to allow for 
displacement of volume by various structures found in 
the interstage. 

4. FLAMMABILITY CRITERIA [1] 

4.1. Hydrogen Flammability Limits 

Flammability of hydrogen occurs between specific 
limits. These limits are a function of temperature, 
pressure, diluents, and ignition energy. Concentration 
limits are normally expressed as percent by volume 
(%v/v). For hydrogen in an air mixture, the Lower 
Flammability Limit (LFL) and Upper Flammability 
Limit (UFL) are 4% and 75%, respectively. In oxygen, 
the limits are 4% and 94%, respectively. 

4.2. Effect of Diluents on Flammability Limits 

A flammability diagram representing the flammability 
limits for hydrogen in the diluent nitrogen at Standard 
Ambient Temperature and Pressure (SATP) is shown in 
Fig. 2. The region inside the red line represents the 
flammability region for different concentrations of 
hydrogen, oxygen, and nitrogen. Outside the red line, 
hydrogen gas is not flammable. 
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Figure 2 Flammability diagram for hydrogen in 
nitrogen at SATP 

4.3. Effect of Temperature on Flammability Limits 

In general, at constant pressure, the flammability range 
of hydrogen expands as temperature increases and 
narrows as the temperature decreases. Fig. 3 shows that 
when temperature increases at constant standard 
pressure, the LFL decreases. 



Figure 3. Effects of temperature on the flammability 
range of hydrogen 


4.4. Effect of Pressure on Flammability Limits 

Similar to temperature, the flammability range of the 
gas expands as pressure increases and narrows as the 
pressure decreases at constant temperature. This is 
apparent since temperature and pressure are also 
positively correlated. The effects of reduced pressure 
on hydrogen flammability in air at standard ambient 
temperature are shown in Tab. 1. 



Table 1. Effects of reduced pressure at standard ambient temperature 


Conditions 

Hydrogen Content 

VOlVo 


Upper propagation 

Downward propagation 

Hydrogen in air at reduced pressure with a 45 mJ (47.5 Btu) ignition source: 1 

Pressure 

kPa 

25 cm Tut>e 

2 L Sphere 


Lower limit 

Upper limit 

Lower limit 

Upper limit 

20 

- 4 

*56 

- 5 

« 52 

10 

- 10 

*42 

* 11 

* 35 

7 

* 15 

* 33 

* 16 

*27 

6 

20-30 


20-25 (at 6.5 kPa) 



4.5. Ignition Energy and Relation to Flammability 
Limits 


LOI = z-LFL = 4% (3) 


Tab. 2 shows pressure effects on the minimum ignition 
energy required to cause combustion of hydrogen in air 
given the hydrogen concentration is within the 
flammability limits. It can be seen that the minimum 
ignition energy increases as the pressure decreases. It 
should also be noted that an electrostatic discharge, i.e. 
shock when touching a doorknob after walking across 
carpet, is normally much greater than the lowest 
minimum ignition energy for hydrogen. 


Table 2. Pressure effects on hydrogen minimum ignition 
energy 


Ignition Energy 

Pressure 

Pressure 

(mJ) 

(kPa) 

(psia) 

0.017 

101.3 

14.7 

0.09 

5.1 

0.735 

0.56 

2.03 

0.294 


4.6. Limiting Oxygen Index 

The Limiting Oxygen Index (LOI) is the minimum 
concentration of oxygen that will support flame 
propagation in a mixture of hydrogen, air, and nitrogen. 
A conservative estimate of the LOI can be found in 
Eq. 1, where z is the stoichiometric amount of oxygen 
required in the combustion reaction. 

LOI = z-LFL (l) 

For example, the combustion reaction for hydrogen is 
shown in Eq. 2. 

2H 2 + 0 2 »2H 2 0 + AH C (2) 

For, this reaction, the heat of combustion, AH C , is 68.1 
kcal/mol. We see in this equation that we require 1 
mole of oxygen to 2 moles of hydrogen for the reaction 
to occur. In this case, z = 1. We further know from 
Tab. 1 that the LFL of hydrogen is approximately 4%. 
Thus, we have Eq. 3 . 


We know experimentally that the true FOI for hydrogen 
is approximately 5%. Thus, we have a conservative 
estimate for the FOI of hydrogen at SATP. 

5. ATMOSPHERIC TEMPERATURE, 
PRESSURE, AND ALTITUDE 

Atmospheric pressure and temperature are positively 
correlated quantities. 

The temperature of the Earth's atmosphere varies with 
altitude, and the mathematical relationship between 
temperature and altitude varies between the different 
atmospheric layers. 

Atmospheric pressure is a direct result of the total 
weight of the air above the point at which the pressure is 
measured. This means that air pressure varies with 
location and time because the amount (and weight) of 
air above the earth varies with location and time. 

Atmospheric pressure decreases with height, dropping 
by 50% at an altitude of about 5.6 km (-185 kft). This 
pressure drop is approximately exponential, so that each 
doubling in altitude results in an approximate decrease 
in pressure by half. However, because of changes in 
temperature throughout the atmospheric column as well 
as the fact that the force of gravity begins to decrease at 
great altitudes, a single equation does not model 
atmospheric pressure through all altitudes. Fike 
temperature, it is modeled differently in each of the 
atmospheric layers. Fig. 4 notionally shows how 
temperature and pressure vary with altitude. 

The model uses temperature and pressure data taken 
from the Program’s Natural Environment Definition for 
Design. These data are expressed as mean temperature 
and pressure along with standard deviations for various 
altitudes above the Eastern Test Range. 






Figure 4. Variation of temperature and pressure in the 
atmosphere 

6. IDEAL GAS LAW 

The ideal gas law is the equation of state of a 
hypothetical ideal gas. The amount of gas n (mol) 
contained in a volume V (ft 3 ) is determined by its 
pressure P (psia) and temperature T (K). The 
relationship is given in Eq. 4. 


considered credible. While the presence of hydrogen 
implies a leak source, oxygen may enter the system 
from leak sources or from incursion of air. In this study, 
all leak sources of either fluid type are assumed to begin 
at T-0 and continue at a constant rate throughout ascent. 

The rate of outgasing is determined by nulling the 
pressure differential at the end of each simulation time 
step throughout ascent. 

The threshold leak sizes required to produce 
deflagration depend upon the LFL, UFL, and FOI. 
These limits are assumed to be based solely on the 
concentration of the gases and pressure since they are 
the most significant factors during ascent. Their values 
are interpolated from data tables at each time step. 

Deflagration occurs whenever the concentration of 
hydrogen and oxygen accumulate to within the 
flammability limits and an ignition source of sufficient 
energy is present. Because numerous energetic sources 
exist in the interstage, an ignition source is assumed. 

For scenarios in which both oxygen and hydrogen are 
leaking, we assumed that no air incursion occurs; thus, 
the only source of oxygen is from leaks and the only 
source of nitrogen is the initial purge. 


PV = nRT (4) 

The constant R = 0.0426 (psia fit 3 / mol K) is the ideal 
gas constant. 

The ideal gas law is most accurate for monatomic gases. 
The approximation breaks down at high pressures and 
low temperatures, where the intermolecular forces play 
a greater role in determining the properties of the gas. It 
does not factor in the size of each gas molecule or the 
effects of intermolecular attraction. 

7. GROUNDRULES AND ASSUMPTIONS 

Initial concentrations of hydrogen, oxygen, and nitrogen 
are based on ground operations analyses. During cryo 
loading from several hours prior to launch until liftoff, a 
nitrogen purge is continuously applied to the interstage, 
which prevents accumulation of hazardous gas leakage. 
At T-0 the nitrogen purge is terminated and a helium 
purge begins entering the engine and continues 
throughout the ascent phase. A small additional amount 
of helium, not considered in the model, comes from a 
helium driven turbine pump. A positive differential 
pressure results in outgasing of nitrogen from liftoff to 
first stage separation. Therefore, in order to achieve the 
necessary threshold concentrations of hydrogen and 
oxygen enabling deflagration, only those scenarios that 
envisage both hydrogen and oxygen sources are 


Mixing of gases within the reference volumes is not 
well understood; therefore, we separately analyzed two 
sets of results: 1) by assuming perfect instantaneous 
mixing, and 2) by using a conservative assumption in 
which all nitrogen is assumed to leave the interstage 
before the hydrogen, oxygen, and helium. Assumption 
2) was used to produce the result shown in this paper. 

8. METHODOLOGY 

The model uses a Monte Carlo simulation to sample 
randomly from various potential flight profiles. Each of 
50,000 iterations per model run begins at T-0 and 
continues until first stage separation. For each iteration, 
the altitude is obtained from the trajectory table and then 
temperature is sampled from a normal distribution based 
on the mean and standard deviation values from the 
Eastern Test Range atmospheric data table, which is 
correlated to ground conditions at time of launch. 
Atmospheric pressure is correlated to the sampled 
temperature via the standard atmosphere model and the 
ideal gas law. The concentrations of hydrogen, oxygen, 
nitrogen, and helium within the interstage are then 
updated using the pressure differential, current 
temperature, moles of gas entering since the last update 
time, and the ideal gas law. 


The nominal ascent trajectories (altitude vs. time) used 
in this study were based on launching from Kennedy 
Space Center to support the International Space Station. 

8.1. Distribution of Leak Sizes 

Estimates of leak size for specific scenarios of interest 
depend largely on expert elicitations with subject matter 
experts. Whenever historical data is available, such as 
experience from the Space Shuttle, statistical data 
analysis methods are used to fit a distribution to the 
data. The data from the Space Shuttle Main Propulsion 
System Feedline Interface Seal (FI) at the hydrogen 
inlet and the (01) seal at the oxygen inlet are good 
examples. These are a Teflon-coated, thin-lipped design 
shown in Fig. 5. The leak check used helium at 25 psig 
with the leakage being measured through a vent port 
connected to a Rota meter flow meter. 



Figure 5. SSME Fl/Ol Feedline Seal 


The seals are fixed, feedline seals similar in design to 
the feedline seals expected to be used in the Ares I 
Upper Stage MPS. Because of their location on the 
Shuttle, these seals experience a more severe flight 
environment than would be seen on Ares I. The 
standardized skewness of the data indicates a highly 
right-skewed distribution. Fig. 6 shows a histogram plot 
of the data. 


Histogram for Ho scirn 



Figure 6. Histogram/lognormal fit: SSME Ol/Fl 
interface helium leak data 


Fig. 7 is a quantile- quantile plot of the data. The data is 
adequately modeled by the lognormal when it plots 
approximately as a straight line. Evidence of lack of fit 
in the right tail is more important than in the body or the 
left tail. There appears to be a good fit in the body and 
right tail of the data to the model; therefore, in this case 
we conclude that the data is adequately modeled by the 
lognormal distribution. 


Probability Plot of Ol/ FI Leak Rate (scim) 

Lognormal - 95% Cl 



Figure 7. Quantile-quantile plot: SSME Ol/Fl 
interface 


Because the leak checks were conducted using helium 
gas, we must estimate the leak size for hydrogen and 
oxygen. The leak rate conversion factor from helium to 
hydrogen and oxygen is based on the ratio of molecular 
weights [3]. 

8.2. Probability of Leak Occurrence 

The Fault Risk Analysis Spreadsheet (FRAS) is a tool 
developed for earlier work on nuclear power plant PRAs 
[4]. It has been used for predicting the probabilities for 
critical events of a phenomenological nature (leaks, 
debonding of thermal protection coatings, ruptures, etc.) 
when applicable historical data are available. 

FRAS estimates defect occurrence frequency and defect 
size in a flight mission from raw, historical defect data 
derived from flight experience and from test and 
inspection discrepancy reports. The raw data is 
modified by applying analyst’s effectiveness factors for 
corrective actions, such as design modification, tests and 
inspections, and other hazard controls. The resultant 
estimate of the mean defect size determines a 
distribution of defect sizes experienced in a mission. 
FRAS has also been used to estimate the frequency of 
random independent leaks in flight by using the 
methods described above. FRAS is not applicable to 
estimating dependent leak events. 


Previous analyses indicated the use of the lognormal 
distribution to represent the leak size distribution [2]. 


The results of all the model runs are compiled in Fig. 8. 
All points in the blue field of the Fig. 8 indicate a 
probability of deflagration beyond the detection ability 
of the model, or less than about 10' 30 . 

The contour plot shows that an oxygen leak rate of 
about Y and a hydrogen leak rate of about X are 
required to get a probability of deflagration of 1 . (Note 
that at this point, the log of probability of deflagration is 
0.) The current combined allowable hydrogen leakage 
limit for the USE and MPS is slightly greater than x. 
Although, this is great enough to cause some concern, 
the current allowable leakage limit for oxygen is 
substantially below y. As long as the total oxygen 
leakage does not exceed y, the risk of deflagration is not 
credible. 


9. SAMPLE RESULTS 

After the Monte Carlo simulation is completed, the 
stored sampling data are used to develop probability 
distributions for the concentrations of hydrogen, 
oxygen, nitrogen, and helium within the interstage as a 
function of time. Recall that deflagration occurs 
whenever the concentrations of hydrogen and oxygen 
are jointly within their lower and upper limits. Direct 
estimation of the probability of deflagration from the 
sampling data is not feasible because the frequency is 
too low. Instead we use the sampling distributions for 
the concentrations of hydrogen and oxygen at each time 
to calculate the joint probabilities of being within the 
deflagration limits. In other words, deflagration occurs 
when the events described in Eq. 5 both occur. 

X(t) > LOI(t) and LFL(t) < Y(t ) < UFL(t) (5) 

Where X(t) is the sampling distribution for oxygen 
concentration at time t and Y(t) is the sampling 
distribution for hydrogen concentration at time t. The 
probabilities of each of these events are calculated from 
the lower and upper tail probabilities. The mission 
probability of deflagration P is calculated from the N 
time step probabilities p(i) as 

J p= i -F[( i - J p(0)- (6) 

i = 1 

This process is carried out for a variety of hydrogen and 
oxygen leak rates, and the results are then compiled into 
a contour map based on initial leak rates, so that given 
any total leak rate for hydrogen and oxygen, a 
probability of deflagration may be ascertained. These 
data may than be used to assess the probability of 
deflagration associated with specific leakage scenarios. 


10. SENSITIVITY ANALYSES PERFORMED (Q . 1 ) 


10.1. Ideal Gas Law Assumption 

A comparison of the ideal gas law and the more 
accurate Van der Waal’s equation of state found results 
agree to within 0.1%. By the time of greatest interest in 
the model, the percent difference is even lower. 
Therefore, the simpler idea gas law is used in the model. 

10.2. Mixing Assumption 

As previously mentioned, two sets of results were run to 
determine the affects of mixing within the interstage. In 
addition to the model runs assuming the nitrogen exits 
the interstage before the hydrogen, oxygen, and helium, 
analyses were also conducted assuming perfect, 
instantaneous mixing of the gases as well as several 
variations that fall between no mixing and perfect 
mixing. The assumption that nitrogen leaves first is 
conservative. Further investigation into the local 
variation in hydrogen and oxygen concentrations is 
being pursued in a related study using computational 
fluid dynamics. 



10.3. Air Incursion Scenarios 


Scenarios involving hydrogen leaks plus air incursion 
were addressed as a sensitivity. Incursion rates of up to 
35,000 scim were examined. The model indicated that 
air incursion as the oxygen source up to the levels 
analyzed, does not enable deflagration. This is because 
air is about 21% oxygen and by the time the model 
suggests deflagration could occur, the LOI is 
significantly greater than 21%. Consequently, the 
relative importance of scenarios involving air incursion 
as the main oxygen source has been downgraded. 

10.4. Venting Assumption 

Pressure profiles from a variety of venting scenarios for 
various flight trajectories were used in some analyses 
rather than assuming the interior pressure equaled the 
atmospheric pressure. In all cases, the pressure lag 
induced by using a realistic venting scenario decreased 
the probability of deflagration since nitrogen did not 
leave the interstage volume as rapidly. Even in cases 
where perfect instantaneous mixing was assumed, the 
instantaneous equilibration of pressure provided higher 
probabilities of deflagration than using a more realistic 
model for pressure. In these cases, the analysis was 
strictly deterministic as not enough data is currently 
available on venting to perform a proper Monte Carlo 
analysis. 

10.5. Modeling Dependent Leaks 

The total leak size is the key factor contributing to the 
probability of deflagration. The total leak size consists 
of nominal leakage plus leakage due to abnormal 
challenges to the system. Multiple leaks may result 
from common susceptibility to a challenge. 

Additionally, the sizes of multiple leaks are likely to be 
positively correlated. Positively correlated leaks pose a 
greater risk of deflagration than uncorrelated leaks. To 
illustrate, consider m hydrogen feedline seal leaks. 
Assume the total leak rate is the sum of m identically 
distributed random variables. The correlation 
coefficient can range from 0 for uncorrelated to 1 for 
perfectly correlation. 

We consider these bounding cases, which are illustrated 
in Fig. 9. In this example, we summed m=10 identically 
distributed lognormal variables (mean= 1,000 scim, error 
factor=5). (The error factor is a measure of dispersion 
equal to the 95th percentile divided by the median.) The 
unshaded curve is the sum of uncorrelated variables 
while the shaded curve represents the sum of perfectly 
correlated variables. The mean of the sum is 10,000 
scim in either case; but, the dispersion is much larger for 
the correlated sum. 
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Figure 9. Perfectly Correlated vs. Uncorrelated Leak 
Sum Distributions 


Assuming the ambient oxygen in the interstage is the 
maximum allowable, it required 4 perfectly correlated 
oxygen leaks for a significant increase in probability of 
deflagration versus more than 10 uncorrelated oxygen 
leaks. In these cases, hydrogen leak rates were assumed 
to be at a worse case level. 

This illustrates the importance of estimating the degree 
of correlation whenever multiple leaks due to a common 
system challenge are considered. Structured expert 
elicitation methods may be helpful in this regard [5]. 
These methods are being pursued as forward work. 

11. SUMMARY AND CONCLUSIONS 

This model allows NASA to estimate the risk of 
deflagration due to hazardous fluid leakage by modeling 
the dynamic flight environment. Instead of using a 
broad system-level approach to arrive at an estimate, the 
most pertinent information is taken into account and 
changes in atmosphere and flammability are examined 
as a function of time. This model also has the benefit of 
being able to accommodate a variety of different 
specific failure scenarios. 

S&MA is responding to requests from NASA’s 
engineering directorate to help them assess the impact 
of design changes on leakage allowables. This model is 
uniquely capable of comparing risks of deflagration 
associated with various potential designs, allowing 
quantitative risk measurements to guide the design of 
Ares I. 

This model is being employed to support 
phenomenological risk modeling within the Ares I 
Upper Stage PRA. The focus of this effort is to work 
within the integrated design teams to identify risk 
drivers and to influence design for improved safety and 
reliability. As the PRA is updated to support all phases 
of the program lifecycle, the model will continue to 
evolve. 
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